Question 1

What is Singapore's PDPA?

Accepted Answer

The Personal Data Protection Act 2012 (PDPA) is Singapore's data protection law governing the collection, use and disclosure of personal data by organizations.

Question 2

Who needs to comply with the PDPA?

Accepted Answer

Organizations undertaking activities involving the collection, use or disclosure of personal data in Singapore generally need to comply with the PDPA's data protection obligations, subject to applicable exceptions.

Question 3

Does the PDPA require consent?

Accepted Answer

The PDPA contains a Consent Obligation requiring organizations to obtain an individual's consent before collecting, using or disclosing personal data for a purpose, unless an applicable exception or alternative basis under the Act applies.

Question 4

What makes consent valid under Singapore's PDPA?

Accepted Answer

An individual must be notified of the purposes for which their personal data will be collected, used or disclosed and provide consent for those purposes. The PDPC also recognizes different forms of consent, including consent that is recorded in writing or otherwise accessible.

Question 5

Can individuals withdraw consent?

Accepted Answer

Yes. Organizations must allow individuals to withdraw consent with reasonable notice and should inform them of the likely consequences of withdrawal.

Question 6

Does the PDPA apply to cookies?

Accepted Answer

The PDPA is not simply a cookie-consent law. Its requirements apply to personal data and the collection, use and disclosure of that data. Where cookies, trackers or similar technologies involve personal data, organizations should assess the applicable PDPA requirements and consent obligations.

Question 7

Does the PDPA provide access and correction rights?

Accepted Answer

Yes. Singapore's PDPA includes obligations relating to access and correction of personal data, subject to applicable conditions and exceptions.

Question 8

Does the PDPA regulate overseas data transfers?

Accepted Answer

Yes. Organizations transferring personal data outside Singapore must comply with the PDPA's Transfer Limitation Obligation and ensure that the transferred personal data receives a standard of protection comparable to that required under the PDPA.

Question 9

What is the Accountability Obligation?

Accepted Answer

Organizations are expected to demonstrate responsibility for personal data in their possession or control, including implementing appropriate policies, practices and processes for data protection.

Question 10

Does ConsentX make an organization PDPA compliant?

Accepted Answer

ConsentX provides technology that can support important PDPA privacy operations, including consent management, purpose-based choices, consent withdrawal, tracker discovery, prior-script blocking, consent evidence and access-request workflows. However, ConsentX does not by itself guarantee compliance. Organizations must assess their complete data-processing activities, policies, contracts, security controls and other obligations under the PDPA.

PDPA Compliance with ConsentX

Who it applies to

Key obligations

How ConsentX helps

Meaningful Consent Management

Purpose-Based Consent

Consent Withdrawal

Tracker & Technology Discovery

Prior-Script Blocking

Consent Records & Audit Evidence

Access & Correction Requests

Geo-Aware Compliance

PDPA Compliance, Made Practical

Често задавани въпроси

Related on ConsentX

Other frameworks